IN THE CLAIMS: 

Claims 1,3, and 15 are amended herein. Claims 9, 16 and 23 are canceled. All 
pending claims are produced below. 



1 . (Currently Amended) A computer implemented method for tracking movement of 
files within a network, the method comprising the steps of: 

a mobility token manager on a source computer detecting an attempt to write a 
file to a target computer; and 

responsive to the detection, the mobility token manager writing encrypting a 
mobility token containing data concerning at least the file and the 
write operation and writing the mobility token t o the target computer. 

2. (Original) The method of claim 1 wherein: 

the mobility token manager is instantiated within a file system filter driver. 

3. (Currently Amended) Tho method of claim 1 whoroin: A computer implemented 
method for tracking movement of files within a network, the method comprising the steps of: 

a mobility token manager on a source computer detecting an attempt to write a 
file to a target computer, wherein t he mobility token manager is 
instantiated as at least one system call wrappe r: and 

responsive to the detection, the mobility token manager writing a mobility 
token containing data concerning at least the file and the write 
operation to the target computer . 

4. (Original) The method of claim 1 wherein: 
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the mobility token contains at least one datum concerning the source computer 
from a group of data consisting of: 
an IP address; 
a computer name; and 
a primary domain controller name. 

5. (Original) The method of claim 1 wherein: 

the mobility token contains at least one datum concerning the file from a 
group of data consisting of: 
a file name; 

a content-based hash value; 

a digital signature; 

a version number; 

a last modification date; and 

a last modification time. 

6. (Original) The method of claim 1 wherein: 

the mobility token contains at least one datum concerning a user who has 

ownership of an application program attempting to write the file to the 

target computer, the datum being from a group of data consisting of: 

a user account name; 

a user account number; and 

a SID. 

7. (Original) The method of claim 1 wherein: 
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the mobility token contains at least one datum concerning the attempt to write 
the file to the target computer, the datum being fi-om a group of data 
consisting of: 

a date of the attempted write operation; and 
a time of the attempted write operation. 

8. (Original) The method of claim 1 fiirther comprising: 

the mobility token manager compressing at least one mobility token. 

9. (Canceled) 

10. (Original) The method of claim 1 fiirther comprising: 

the mobility token manager hiding at least one mobility token. 

11. (Original) The method of claim 1 fiirther comprising: 

the mobility token manager on the source computer determining whether 

another mobility token manager is running on the target computer; and 

the mobility token manager on the source computer only writing a mobility 
token to the target computer responsive to determining that another 
mobility token manager is running on the target computer. 

12. (Original) The method of claim 1 further comprising: 

before writing a mobility token to the target computer, the mobility token 

manager determining whether a mobility token associated with the file 
exists; 
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responsive to results of the determination, the mobiUty token manager 
performing a step from a group of steps consisting of: 
responsive to determining that an associated mobility token exists, 

writing information concerning at least the file and the write 

operation to the mobility token; and 
responsive to determining that an associated mobility token does not 

exist, creating an associated mobility token containing 

information concerning at least the file and the write operation. 

13. (Original) The method of claim 1 further comprising: 

the mobility token manager writing at least one instruction directed to a target 
computer in the mobility token. 

14. (Original) The method of claim 1 wherein: 

the mobility token contains an indication that the associated file has been 

scanned by an anti-malicious code scanning engine, and an indication 
of a malicious code definition file used for the anti-mahcious code 
scanning. 

15. (Currently Amended) A computer implemented method for tracking movement 

of files within a network, the method comprising the steps of: 

a mobility token manager on a target computer detecting that a mobility token 

is being written to the target computer; 
the mobility token manager reading the mobility token; aad 
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the mobility token manager determining relevant information concerning a 

file associated with the mobility toke n; and 
the mobility token manager merging data from the mobility token into a 

mobility token data store containing information fi'om at least one 

other mobility token . 

16. (Canceled) 

17. (Original) The method of claim 15 fiirther comprising: 

the mobility token manager reading at least one instruction for a source 

computer in the mobility token; and 
the mobility token manager executing the at least one instruction. 

18. (Original) The method of claim 15 further comprising: 

the mobility token manager reading the mobility token; and 
in response to contents of the mobility token, the mobility token manager 
rejecting the associated file. 

19. (Original) The method of claim 15 further comprising: 

the mobility token manager reading the mobility token; 

from the contents of the mobility token, the mobility token manager 

determining whether the associated file has been scanned by an anti- 
malicious code scanning engine using a current malicious code 
definition file; and 

in response to determining that the file has not been scanned using a current 
malicious code definition file, scanning the file for malicious code. 
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20. (Original) The method of claim 15 wherein: 

the mobility token manager is instantiated within a file system filter driver. 

21. (Original) The method of claim 15 wherein: 

the mobility token manager is instantiated as at least one system call wrapper. 

22. (Original) A computer system for tracking movement of files within a network, 

the computer system comprising: 

a software portion configured to detect an attempt to write a file to a target 
computer; and 

a software portion configured to write a mobility token containing data 
conceming at least the file and the write operation to the target 
computer, responsive to the detection. 

23. (Canceled) 
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